Latest Fortinet FortiSandbox vulnerabilities: CVE-2026-39808, and CVE-2026-39813 #
Fortinet disclosed in two advisories that multiple vulnerabilities have been identified in versions of FortiSandbox.
- CVE-2026-39808: An OS command injection vulnerability exists within an API endpoint due to the improper neutralization of special elements. A remote, unauthenticated attacker could exploit this vulnerability by sending specially crafted HTTP requests, potentially allowing for the execution of unauthorized code or commands. This vulnerability has been designated CVE-2026-39808 and has been rated critical with a CVSS score of 9.1.
- CVE-2026-39813: An API privilege escalation vulnerability exists due to a path traversal flaw. A remote, unauthenticated attacker could exploit this vulnerability by sending specially crafted HTTP requests to the JRPC API. Successful exploitation may allow an attacker to bypass authentication and escalate privileges on the system. This vulnerability has been designated CVE-2026-39813 and has been rated critical with a CVSS score of 9.1.
The following versions are affected:
- FortiSandbox 4.4: Versions 4.4.0 through 4.4.8 (affected by both CVEs)
- FortiSandbox 5.0: Versions 5.0.0 through 5.0.5 (affected by CVE-2026-39813 only)
What is Fortinet FortiSandbox? #
Fortinet FortiSandbox is a security appliance that identifies unknown threats by executing suspicious files in isolated virtual environments to monitor their behavior and then automates a response by sharing that intelligence across the network to block the detected threat.
What is the impact? #
Successful exploitation of these vulnerabilities would allow an attacker to gain unauthorized API access, enabling them to escalate privileges and execute code or commands on the vulnerable host.
Are updates or workarounds available? #
Users are encouraged upgrade affected systems to the following versions:
- FortiSandbox 4.4: Upgrade to 4.4.9 or later
- FortiSandbox 5.0: Upgrade to 5.0.6 or later
How to find potentially vulnerable systems with runZero #
From the Asset Inventory, use the following query to locate potentially impacted assets:
os:="Fortinet FortiSandbox%"
